Open Redirect Vulnerability in WPO365 | Microsoft 365 Graph Mailer Plugin

CVE-2025-1488

Summary

The WPO365 | Microsoft 365 Graph Mailer plugin for WordPress is susceptible to an Open Redirect vulnerability across all versions up to and including 3.2. This issue arises from inadequate validation of the redirect URL provided via the 'redirect_to' parameter. As a result, unauthenticated attackers may exploit this flaw to redirect unsuspecting users to malicious websites if they can deceive them into performing a certain action. This is particularly concerning when the plugin is active but not properly configured, leaving users exposed to potential phishing attacks.

References